Description
Use-after-free vulnerability in the AttributeSetter function in bindings/templates/attributes.cpp in the bindings in Blink, as used in Google Chrome before 33.0.1750.152 on OS X and Linux and before 33.0.1750.154 on Windows, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving the document.location value.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 7 | chromium-browser | 33.0.1750.152-1~deb7u1 | DSA-2883-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | chromium | 55.0.2883.75-3.1 | openSUSE-SU-2024:12948-1, openSUSE-SU-2024:10171-1 |
Advisories 3
- DSA-2883-1 chromium-browser - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10171-1 chromedriver-55.0.2883.75-3.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12948-1 ungoogled-chromium-113.0.5672.92-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- DSA-2883 vendor-advisory
- 20140326 VUPEN Security Research - Google Chrome Blink "locationAttributeSetter" Use-after-free (Pwn2Own) mailing-list
- APPLE-SA-2014-04-22-2 vendor-advisory
- https://support.apple.com/kb/HT6537
- APPLE-SA-2014-04-22-3 vendor-advisory
- GLSA-201408-16 vendor-advisory
- http://googlechromereleases.blogspot.com/2014/03/stable-channel-update-for-chrome-os_14.html
- openSUSE-SU-2014:0501 vendor-advisory
- APPLE-SA-2014-04-01-1 vendor-advisory
- https://code.google.com/p/chromium/issues/detail?id=352374
- http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_14.html
- https://src.chromium.org/viewvc/blink?revision=169176&view=revision